lc. Identity Tools
Tools

LDAP filters

Paste an LDAP filter to validate it against RFC 4515, see it indented and read in plain words what it searches for, with AD flags and matching rules explained. It also escapes values and builds the PowerShell query.

Processed locally, in your browser
Filter

On one line or indented; whitespace between components is ignored.

Escape a value

Escapes * ( ) \ and NUL per RFC 4515. Paste a SID (S-1-5-21-…) or a GUID to also get its binary form for objectSid / objectGUID searches.

Result

Paste an LDAP filter to analyse it.

Good to know

  • memberOf only lists direct membership. To include nested groups use the 1.2.840.113556.1.4.1941 rule (LDAP_MATCHING_RULE_IN_CHAIN), which is exact but can be expensive on large hierarchies.
  • In AD, computer inherits from user: (objectClass=user) also returns computers. For people, combine it with (objectCategory=person).
  • A leading wildcard (cn=*sales) cannot use the attribute index and forces a walk through every object in scope.
  • (!(attribute=value)) also returns objects that do not have that attribute. If that is not what you want, add (attribute=*).